savsis
7cc50973f6
User ask, paraphrased: install it, get help wiring up payments, and
immediately have a ready site under your own name — not "MBS Panel"
plastered everywhere and a bunch of manual follow-up.
Two things were actually broken/missing, found by tracing every surface
a real customer or the operator would see:
1. "MBS Panel" was hardcoded in ~20 places (bot messages, subscription
page, admin panel splash/title/sidebar, legal pages, 2FA issuer,
install.sh) with zero way to change it short of editing source.
New BRAND_NAME config value (config.py default "MBS Panel", so this
is 100% backward compatible for existing installs) wired through
everywhere via the same live-settings pattern from the last commit
(settings.get_brand_name(), no restart needed anywhere it's used).
New Настройки → «Название» section in the admin panel to change it.
2. site/index.html and site/cabinet.html — a fully-built landing page +
personal-cabinet template, already in the repo — were never actually
served by anything. Not mounted by FastAPI, not deployed by
install.sh, not linked from anywhere. Pure dead weight: a repo that
looked like it shipped a client site but didn't. Now legal.py gets a
render_site_page() (same {{TOKEN}} substitution + HTML-escaping as
the existing offer/privacy renderer, new tokens: BRAND_NAME,
SITE_DOMAIN, SUB_DOMAIN, BOT_USERNAME) and GET "/" serves the branded
landing page on any host that isn't PANEL_DOMAIN (in practice:
SUB_DOMAIN, which nginx already routes to this backend — zero
install.sh/nginx/certbot changes needed, so this is live on every
existing install without an upgrade step beyond `mbs update`).
GET /cabinet.html serves the cabinet. Landing page's pricing section
now fetches real, live prices from a new public GET /api/plans
instead of showing static duration labels with no numbers.
Also fixed along the way, same staleness-bug class as the payments/HWID
fix last commit, found by grepping for every remaining frozen `from
config import ...` in api.py: BOT_TOKEN/BOT_USERNAME were still frozen
constants in api.py (mbs-api never restarts itself). Concretely this
meant: changing the bot via Настройки → Telegram-бот would leave
_tg_send_message (payment-received notifications) silently trying the
OLD token, admin_get_bot_settings showing the OLD username right after
a successful save, and gift-code links pointing at the OLD bot — all
until a manual mbs restart, same shape as the Platega-secret bug fixed
last commit. Added settings.bot_credentials(), wired it through every
call site (hoisted out of loops where relevant, same N+1 discipline as
always), removed the now-stale "выполни mbs restart" copy from the bot
settings hint.
legal.py's own BOT_USERNAME import was frozen too (used by the /offer
and /privacy {{BOT_USERNAME}} token) — switched to reading it live
in-module (no settings.py import from legal.py, would've been circular
since settings.py already imports legal.py for the env reader).
install.sh: new interactive prompt for the brand name (default "MBS
Panel", so hitting enter reproduces today's behavior exactly), written
to .env, echoed in the final summary along with the now-live site URL.
Verification: same story as always — api.py/bot.py still can't import
locally (no pydantic-core wheel for Python 3.14 on this machine).
py_compile + pyflakes clean across the whole repo. Real runtime test
against an isolated .env fixture: brand name and bot-credential live
reads (no reimport), render_site_page() token substitution correctness
on the actual site/index.html and site/cabinet.html files including an
XSS check (brand name containing <script> comes out HTML-escaped), and
a regression check that adding the BRAND_NAME token to the existing
legal.render() didn't break offer.html/privacy.html. Extracted
SUB_PAGE_TEMPLATE/SUB_PAGE_EXPIRED_TEMPLATE via ast from api.py (can't
import the module, but can pull the string constants) and ran the real
.format() calls against them to catch any brace-escaping mistake in the
new {brand_name} placeholder — CSS braces in those templates are
already double-escaped for .format(), easy to get wrong. Extracted and
node --check'd admin.html's whole inline script, div-tag-balance check
on the full file. install.sh's new prompt+heredoc snippet run standalone
with piped stdin (both a brand name with spaces and an empty/default
input), round-tripped the resulting .env back through the real
env-parsing logic. Extended the existing CI "app wiring" step (which
does import api/bot for real on Linux) with branding assertions calling
the actual route functions directly (api.root(), api.public_plans(),
api.public_branding()) — ran every part of that step's new logic that
doesn't need api.py locally first, to catch what's catchable before
trusting the rest to CI once the account's abuse-review lifts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
89 lines
2.7 KiB
Python
89 lines
2.7 KiB
Python
import config
|
|
import legal
|
|
|
|
PRICE_ENV_KEYS = {"7d": "PRICE_7D", "1m": "PRICE_1M", "3m": "PRICE_3M", "6m": "PRICE_6M", "1y": "PRICE_1Y"}
|
|
|
|
|
|
def _bool(raw: str, default: bool) -> bool:
|
|
if raw is None or raw == "":
|
|
return default
|
|
return raw.strip().lower() == "true"
|
|
|
|
|
|
def _positive_int(raw: str, default: int) -> int:
|
|
if raw and raw.strip().lstrip("-").isdigit():
|
|
parsed = int(raw)
|
|
if parsed >= 0:
|
|
return parsed
|
|
return default
|
|
|
|
|
|
def get_plans() -> list:
|
|
raw = legal.read_env_vars(list(PRICE_ENV_KEYS.values()))
|
|
plans = []
|
|
for p in config.PLANS:
|
|
env_key = PRICE_ENV_KEYS[p["code"]]
|
|
plans.append({
|
|
"code": p["code"],
|
|
"label": p["label"],
|
|
"days": p["days"],
|
|
"price": _positive_int(raw.get(env_key), p["price"]),
|
|
})
|
|
return plans
|
|
|
|
|
|
def get_plans_by_code() -> dict:
|
|
return {p["code"]: p for p in get_plans()}
|
|
|
|
|
|
def set_plan_prices(prices: dict):
|
|
for code, price in prices.items():
|
|
if code in PRICE_ENV_KEYS:
|
|
legal.update_env_var(PRICE_ENV_KEYS[code], str(int(price)))
|
|
|
|
|
|
def get_payment_settings() -> dict:
|
|
raw = legal.read_env_vars(["PAYMENTS_ENABLED", "YOOKASSA_ENABLED", "PLATEGA_ENABLED"])
|
|
return {
|
|
"payments_enabled": _bool(raw.get("PAYMENTS_ENABLED"), config.PAYMENTS_ENABLED),
|
|
"yookassa_enabled": _bool(raw.get("YOOKASSA_ENABLED"), config.YOOKASSA_ENABLED),
|
|
"platega_enabled": _bool(raw.get("PLATEGA_ENABLED"), config.PLATEGA_ENABLED),
|
|
}
|
|
|
|
|
|
def yookassa_credentials():
|
|
raw = legal.read_env_vars(["YOOKASSA_SHOP_ID", "YOOKASSA_SECRET_KEY"])
|
|
return (
|
|
raw.get("YOOKASSA_SHOP_ID") or config.YOOKASSA_SHOP_ID,
|
|
raw.get("YOOKASSA_SECRET_KEY") or config.YOOKASSA_SECRET_KEY,
|
|
)
|
|
|
|
|
|
def platega_credentials():
|
|
raw = legal.read_env_vars(["PLATEGA_MERCHANT_ID", "PLATEGA_SECRET"])
|
|
return (
|
|
raw.get("PLATEGA_MERCHANT_ID") or config.PLATEGA_MERCHANT_ID,
|
|
raw.get("PLATEGA_SECRET") or config.PLATEGA_SECRET,
|
|
)
|
|
|
|
|
|
def get_brand_name() -> str:
|
|
raw = legal.read_env_var("BRAND_NAME", "")
|
|
return raw.strip() if raw.strip() else config.BRAND_NAME
|
|
|
|
|
|
def bot_credentials():
|
|
raw = legal.read_env_vars(["BOT_TOKEN", "BOT_USERNAME"])
|
|
return (
|
|
raw.get("BOT_TOKEN") or config.BOT_TOKEN,
|
|
raw.get("BOT_USERNAME") or config.BOT_USERNAME,
|
|
)
|
|
|
|
|
|
def get_hwid_settings() -> dict:
|
|
raw = legal.read_env_vars(["HWID_LIMIT_ENABLED", "HWID_FALLBACK_LIMIT"])
|
|
limit = _positive_int(raw.get("HWID_FALLBACK_LIMIT"), config.HWID_FALLBACK_LIMIT)
|
|
return {
|
|
"enabled": _bool(raw.get("HWID_LIMIT_ENABLED"), config.HWID_LIMIT_ENABLED),
|
|
"fallback_limit": limit if limit > 0 else config.HWID_FALLBACK_LIMIT,
|
|
}
|